topic Re: user fields contains comma in value. Best way to have field value include first and last name? in Splunk Search

user fields contains comma in value. Best way to have field value include first and last name?

ericrobinson — Fri, 20 Jun 2014 16:46:17 GMT

My field in the events is as follows

UserFullName=Lastname, Firstname ,

I know that I can use a regex to extract the fields and concantenante the fields using eval to create a new fullname field. That just seems a long way around.

Thanks.

Re: user fields contains comma in value. Best way to have field value include first and last name?

martin_mueller — Fri, 20 Jun 2014 17:19:08 GMT

The best way would be to have the value enclosed in double quotes in the event like this:

UserFullName="Lastname, Firstname I."

Then Splunk will automatically extract the full value into the field.

Re: user fields contains comma in value. Best way to have field value include first and last name?

ericrobinson — Fri, 20 Jun 2014 18:30:58 GMT

I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.

Re: user fields contains comma in value. Best way to have field value include first and last name?

martin_mueller — Fri, 20 Jun 2014 18:41:10 GMT

What you do in rex can be moved to the field extraction configuration.

What do you need eval for?